NtApiDotNet 1.1.2

.NET Framework 4.5 This package targets .NET Framework 4.5. The package is compatible with this framework or higher.
There is a newer version of this package available.
See the version list below for details. 
dotnet add package NtApiDotNet --version 1.1.2                

                    
                

            
NuGet\Install-Package NtApiDotNet -Version 1.1.2
This command is intended to be used within the Package Manager Console in Visual Studio, as it uses the NuGet module's version of Install-Package. 
<PackageReference Include="NtApiDotNet" Version="1.1.2" />
For projects that support PackageReference, copy this XML node into the project file to reference the package. 
paket add NtApiDotNet --version 1.1.2                

                    
                

            
#r "nuget: NtApiDotNet, 1.1.2"
#r directive can be used in F# Interactive and Polyglot Notebooks. Copy this into the interactive tool or source code of the script to reference the package. 
// Install NtApiDotNet as a Cake Addin
#addin nuget:?package=NtApiDotNet&version=1.1.2

// Install NtApiDotNet as a Cake Tool
#tool nuget:?package=NtApiDotNet&version=1.1.2

A .NET class library to access native NT API system calls

Product Compatible and additional computed target framework versions.
.NET Framework net45 is compatible.  net451 was computed.  net452 was computed.  net46 was computed.  net461 was computed.  net462 was computed.  net463 was computed.  net47 was computed.  net471 was computed.  net472 was computed.  net48 was computed.  net481 was computed. 
Compatible target framework(s)
Included target framework(s) (in package)
Learn more about Target Frameworks and .NET Standard.

This package has no dependencies.

NuGet packages (1)

Showing the top 1 NuGet packages that depend on NtApiDotNet:

Package Downloads
NtApiDotNet.Forms

A .NET class library to access native NT API system calls

GitHub repositories (11)

Showing the top 5 popular GitHub repositories that depend on NtApiDotNet:

Repository Stars
CCob/SweetPotato
Local Service to SYSTEM privilege escalation from Windows 7 to Windows 10 / Server 2019
CCob/BeaconEye
Hunts out CobaltStrike beacons and logs operator command output
lowleveldesign/wtrace
Command line tracing tool for Windows, based on ETW.
cyberark/RPCMon
RPC Monitor tool based on Event Tracing for Windows
CCob/okta-terrify
Okta Verify and Okta FastPass Abuse Tool
Version Downloads Last updated
1.1.33 5,753 1/22/2022
1.1.32 6,730 8/18/2021
1.1.31 2,330 3/16/2021
1.1.30 641 1/15/2021
1.1.29 1,343 11/23/2020
1.1.28 3,613 6/30/2020
1.1.27 3,094 2/10/2020
1.1.26 949 1/21/2020
1.1.25 710 1/2/2020
1.1.24 732 12/10/2019
1.1.23 923 10/18/2019
1.1.22 2,208 4/30/2019
1.1.21 1,326 4/23/2019
1.1.20 1,020 3/9/2019
1.1.19 2,032 2/4/2019
1.1.18.1 737 2/4/2019
1.1.18 694 2/4/2019
1.1.17 2,304 9/9/2018
1.1.16 1,225 8/1/2018
1.1.15 1,238 6/18/2018
1.1.14 1,295 5/1/2018
1.1.13 1,137 4/4/2018
1.1.12 1,319 3/19/2018
1.1.11 1,164 3/4/2018
1.1.10 1,509 3/1/2018
1.1.9 1,571 2/22/2018
1.1.8 1,315 2/6/2018
1.1.7 1,710 1/11/2018
1.1.6 1,061 12/3/2017
1.1.5 1,055 11/23/2017
1.1.4 1,136 11/14/2017
1.1.3 1,256 11/5/2017
1.1.2 1,359 10/11/2017
1.1.1 1,203 8/30/2017
1.1.0 954 8/30/2017
1.0.9 994 8/19/2017
1.0.8 1,108 8/7/2017
1.0.7 1,072 6/14/2017
1.0.4 1,039 5/17/2017

1.1.2
-----
* Added Get-AccessibleHandle cmdlet.
* Support for oplock levels.
* Added support to set inherit and protect on close flags to objects.
* Added Get-NtFilePath function.
1.1.1
-----
* Fix to native protected process creation.
* Added functions to create native NT processes.
1.1.0
-----
* Removed check tools, excluding CheckNetworkAccess.
* Added basic Job object cmdlets.
* Added creation of protected processes in Win32Process.
* Added service access checking cmdlet.
* Added get executable manifest cmdlet.

1.0.9
-----
* Made New-Win32Process more generic and added support for Win32k filter enable.
* Added function to capture token from a process using impersonation.
* Added basic support for Desktop and WindowStation objects using Win32u.dll exports.
* Added file locking implementation including async.
* Added hardlink enumeration.
* Added NTFS stream enumeration.
* Deprecated most of the old standalone utilities in favour of PS cmdlets.

1.0.8
-----
* Added cmdlets to create a kernel memory dump, system environment and licensing.
* Additional system calls implemented.
* Added access to secure boot policies and code integrity policies.
* Made Win32 Process creation more generic and added cmdlet.
* Added access check by type including SELF SID.

1.0.7
-----
* Added new cmdlets to do access checking. Many of the old standalone utilities are now deprecated.
* Added cmdlets to create lowbox tokens
* Added list of known capability SIDs and resolve them during name lookup
* Added cmdlet to get a SID
* Added cmdlet to do a standalone access checking
* Reworked the APIs to include non-throwing versions of many of the core Open/Create methods.
* Made NtType more inspectable, includes access enumeration and rationalizes the opening methods.
* Various additional properties such as extended process flags, checking for LPAC
* Rework of access mask handling. Now all low-level APIs use an AccessMask structure which has
 conversion operators to and from other enumerations.
* Various other bug fixes.

1.0.6
-----
* Added cmdlet to filter a Token object.
* Cleanups to various components to make them easier to use from PS

1.0.5
-----
* Added additional Known SIDs
* Unified the variant Get-NtToken* cmdlets into one.
* Added additional token cmdlets such as Logon and Clipboard.
* Added initial support for IO Completion Ports
* Added object creation time property
* Added support to set a process device map
* Added top level CanSynchronize property to NtObject
* Bugs fixes from Rustam Agametov
* Made process list in token viewer a list rather than a tree and made a separate handle tab.

1.0.4
-----
* First NUGET release.